Created on
‎06-09-2023
01:35 AM
Edited on
‎06-09-2023
01:53 AM
By
Jean-Philippe_P
Description | This article provides configuration and verification steps to optimize an NP7-based FortiGate. |
Scope | FortiGate with Network Processor 7. |
Solution |
While deploying FortiGate which uses NP7, it is important to verify that the default queues are present in the configuration. The default queues can be missing in certain cases such as: - Incorrect migration of configuration file from older hardware to NP7 unit. - Upgrading the NP7 FortiGate from older firmware (that does not have the queue feature) to the latest firmware.
Hence, it is important to double-check if the Fortigate is running with the default queues as mentioned in this document.
In addition to the above-mentioned default queues, customized queues can be utilized for specific user traffic as explained in this document.
Failure to enable the default queues: - may result in all traffic going via the default queue. - sub-optimal traffic processing by the FortiGate. - in the worst-case scenario, this may result in the issue described in this article.
The queue utilization can be seen from the output of the following command (note: it needs to be run at least 5 to 10 times, over a fixed time interval) to get the best results.
1) When the default NP7 queue configuration is missing, it is possible to see that the majority of the traffic is processed by Queue_0:
config global config system npu <empty> end
2) When the default NP7 queues are configured:
config system npu config np-queues config ethernet-type edit "ARP" set type 806 set queue 9 next edit "HA-SESSYNC" set type 8892 set queue 11 next edit "HA-DEF" set type 8890 set queue 11 next edit "HC-DEF" set type 8891 set queue 11 next edit "L2EP-DEF" set type 8893 set queue 11 next edit "LACP" set type 8809 set queue 9 next end config ip-protocol edit "OSPF" set protocol 89 set queue 11 next edit "IGMP" set protocol 2 set queue 11 next edit "ICMP" set protocol 1 set queue 3 next end config ip-service edit "IKE" set protocol 17 set sport 500 set dport 500 set queue 11 next edit "BGP" set protocol 6 set sport 179 set dport 179 set queue 9 next edit "BFD-single-hop" set protocol 17 set sport 3784 set dport 3784 set queue 11 next edit "BFD-multiple-hop" set protocol 17 set sport 4784 set dport 4784 set queue 11 next edit "SLBC-management" set protocol 17 set dport 720 set queue 11 next edit "SLBC-1" set protocol 17 set sport 11133 set dport 11133 set queue 11 next edit "SLBC-2" set protocol 17 set sport 65435 set dport 65435 set queue 11 end It can display more queues being utilized, for example, Queue_3 and Queue_9, and Queue_11 in this case.
|